1. Ch 13 Trustworthiness Myungchul Kim mckim@icu.ac.kr

2. 2 o Facets of trustworthiness in networked computing systems – Availability – Security o Availability – Intrinsic reliability: software bugs, configuration and operation, emergent behavior -> techniques for fault tolerance and graceful crash recovery: equipment redundancy, data replication, data persistence – Security: countering deliberate threats

3. 3 o Security measures – The integrity of the message. – The signature provides authentication, which means a provable identification. – Confidential. – The inability of Alice to later deny she sent the message is called nonrepudiation. – Trusted authority

4. 4 o Fig 13.1

5. 5 o Examples of threats to messages communicated using the network – Interruption: the delivery of a legitimate message is prevented. – Interception: a message is observed by an intruder and its contents noted. – Modification: a message is modified before it is passed to the recipient. – Fabrication: a message is fabricated, including a false identity for the sender. – Computer virus – Denial of service attack: injecting vast amounts of artificial work or communications that cause a host or network to become overloaded and degrade the performance for legitimate users or crash the application altogether.

6. 6

7. 7 o Confidentiality – Encryption and Decryption – Symmetric and asymmetric systems – Fig 13.3

8. 8 – The asymmetric locking key is called a public key and the asymmetric unlocking key is called a secret key. – Fig 13.4

9. 9 o Encryption algorithms – Confidentiality does not depend on the secrecy of the algorithms. – Symmetric protocol: E SK (P) -> C, D SK (C) -> P where E: encryption, D: decryption, SK: secret key, P: plaintext, C: ciphertext – Asymmetric protocol: E BPK (P) -> C, D BSK (C) -> P where E: encryption, D: decryption, BPK: Bob’s public key, BSK: Bob’s secret key, P: plaintext, C: ciphertext

10. 10 – Fig 13.5

11. 11 o authentication – Verifying the identity of a party over the network – Impersonation is easy over the network – Authentication depends on a trusted third party, called an authority – Biometrics – Challenge-response protocol

12. 12 – Fig 13.6

13. 13 – Digital certificate and certificate authorities (Fig 13.7)

14. 14 – Digital signature (Fig 13.8)

15. 15 o Open issues – Increasing vulnerability – National security and law enforcement